EUVD-2026-107010
GHSA-2mgh-5pqv-xpqq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain any account incl. read-only reader
-
DeliverySubmit Gremlin Groovy to POST /api/v1/command/{database}
-
ExploitBypass missing scripting authorization check
-
ExecutionExecute OS commands as server user
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires (1) the Groovy scripting engine to be enabled on the ArcadeDB instance (reflected as AT:P), and (2) any authenticated account, explicitly including the read-only 'reader' role, with reachable access to the POST /api/v1/command/{database} HTTP endpoint. The flaw is that GremlinQueryEngine.command() performs no scripting authorization check, so no elevated role is needed. Limiting factors: valid credentials are mandatory (PR:L - not unauthenticated), the Groovy engine must be enabled rather than relying on a default, and the API endpoint must be network-reachable to the attacker; versions at or above 26.10.1 are not affected. |
| Impact | This is a credible, actionable RCE but not a mass-exploitation emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) and the description agree: it is network-reachable but requires a valid account (PR:L) and a specific attack requirement (AT:P) - the Groovy engine being enabled. The standout risk factor is the trust-boundary violation flagged by CWE-863: even the lowest-privilege 'reader' role (intended as read-only) can reach code execution, so any account that should be harmless becomes a path to OS command execution as the server process user (VC:H/VI:H/VA:H). No EPSS score, KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this is a high-impact but low-signal-of-exploitation issue whose real priority depends on exposure of the ArcadeDB API and how liberally reader accounts are handed out. Note a tag/data conflict: the input tags this 'Authentication Bypass,' but the description and CWE-863 describe an authorization (privilege) failure for already-authenticated users, not an authentication bypass - treat the authorization framing as authoritative. |
| Exploit ScenarioDerived | An attacker holding any ArcadeDB account - including a low-trust, read-only 'reader' role or a leaked/shared credential - sends a Gremlin command containing Groovy to the POST /api/v1/command/{database} endpoint on an instance where the Groovy engine is enabled. Because GremlinQueryEngine.command() performs no scripting authorization check, the Groovy executes and runs arbitrary OS commands as the server process user, yielding full host compromise. No public exploit was identified in the provided data, but the technique is straightforward to reproduce from the advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
ArcadeDB deployments running any version before 26.10.1 can be coerced into executing arbitrary operating-system commands by any authenticated user who can reach the POST /api/v1/command/{database} endpoint, provided the Groovy scripting engine is enabled on the instance. The root cause is a missing authorization check in GremlinQueryEngine.command(), which means role restrictions are never enforced for Gremlin-submitted Groovy code, so even an account holding the read-only 'reader' role can elevate from query access to full server-process code execution. There is no indication of active exploitation in the wild and no public exploit code identified at time of analysis, but exploitation is straightforward for an insider or anyone holding low-privilege credentials, and the attack surface is limited only by whether the Groovy engine is turned on and the API is network-reachable.
RemediationAI
Upgrade ArcadeDB to version 26.10.1 or later, which introduces the missing scripting authorization check in GremlinQueryEngine.command(); this is the only complete fix and should be applied to every instance, including development and staging systems that share credentials or network position with production. Where an immediate upgrade is not possible, disable the Groovy scripting engine on affected instances - this blocks the vulnerable code path but will break any legitimate Gremlin workloads that rely on inline Groovy closures, so validate query compatibility first. In parallel, restrict network access to POST /api/v1/command/{database} through a reverse proxy or firewall allowlist so that only trusted application hosts and operators can reach it (side effect: any legitimate remote client outside the allowlist loses access), and audit credentials issued to the read-only 'reader' role, rotating or removing any that are not strictly required, since reader accounts are sufficient for exploitation. Review ArcadeDB logs for Gremlin command submissions containing script or process-execution constructs from low-privilege accounts to detect prior abuse. Full technical details and vendor guidance are available at https://github.com/ArcadeData/arcadedb/security/advisories/GHSA-h2j4-28h8-cj5v and https://www.vulncheck.com/advisories/arcadedb-before-26.10.1-rce-via-gremlin-groovy-engine-missing-authorization.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ArcadeDB is a multi-model (graph, document, key-value) database written in Java that exposes an HTTP API, including a command endpoint at POST /api/v1/command/{database} used to submit Gremlin, SQL, and other language queries. Gremlin traversal queries can carry Groovy closures and inline scripts, which the embedded Groovy engine evaluates with the privileges of the ArcadeDB server process; that is a documented and intended capability of Gremlin, not in itself a bug. The defect is classified as CWE-863 (Incorrect Authorization): GremlinQueryEngine.command() dispatches submitted Gremlin/Groovy content without consulting the scripting authorization layer that governs other query engines, so the role model that should gate script execution is silently bypassed. Consequently the reader role, which is designed to permit only data reads, retains enough reach through this code path to instantiate arbitrary classes and invoke OS-level process execution as the user running the ArcadeDB service. Severity is moderated by two deployment preconditions rather than by cryptographic or privilege barriers: the Groovy engine must be enabled (the assessment encodes this as AT:P in the CVSS 4.0 vector, and as a high attack-complexity component in the CVSS 3.1 view), and the attacker must already hold valid credentials (PR:L) and have network access to the command endpoint. Versions at or above 26.10.1 are not affected.
Know when Arcadedb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network endpoint with low-privilege authenticated access (PR:L); AC:H because exploitation depends on the non-default Groovy engine being enabled; code runs within the server's own authority so S:U with full C/I/A impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role holders, to execute Groovy code because GremlinQueryEngine.command() lacks scripting authorization checks. Attackers can submit Gremlin commands to the POST /api/v1/command/{database} endpoint when the Groovy engine is enabled to run OS commands as the server process user.
Technical POC Analysis
CWE-863 (Incorrect Authorization) - a missing authorization check on a privileged code path, not a logic error in an existing check.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
ArcadeDB versions prior to 26.10.1 contain a high-severity authorization bypass that can lead to arbitrary operating-system command execution when the Groovy scripting engine is enabled, putting database servers and connected applications at risk of full compromise. The issue is especially concerning because it can be triggered through a standard query endpoint, meaning any exposure of that endpoint with Groovy enabled expands the attack surface. No public exploit has been identified at time of analysis, but the potential for data loss, service disruption, and lateral movement warrants immediate leadership attention.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Related Vulnerabilities in ArcadeDB Authorization Bypass Vulnerabilities
View all 4Unauthenticated data access and manipulation in ArcadeDB before 26.8.1 arises because the Redis wire-protocol plugin exp
Privilege escalation in ArcadeDB server (versions 26.7.3 and earlier) allows a low-privileged authenticated user with re
Privilege escalation in ArcadeDB before 26.8.1 lets a low-privileged authenticated reader escalate to full server admini
Authentication bypass in ArcadeDB before 26.8.1 lets unauthenticated attackers run full CRUD operations against any data
Scripting authorization bypass in ArcadeDB before 26.7.2 lets any authenticated database user - including read-only role
Cross-database authorization bypass (IDOR) in ArcadeDB before 26.7.2 lets attackers read and write any database on the s
Remote code execution in ArcadeDB's Gremlin query engine exposes any deployment running arcadedb-gremlin through version
Cross-database authorization bypass in ArcadeDB's Gremlin wire-protocol plugin allows any authenticated server user to f
Arbitrary file read in ArcadeDB before version 26.8.1 allows authenticated users holding trigger creation privileges to
Cluster token exposure in ArcadeDB before 26.7.2 enables any authenticated user to escalate privileges to root-level adm
Privilege escalation in ArcadeDB before 26.7.3 allows any user holding UPDATE_SCHEMA permission to create server-wide ad
Remote OS command execution in ArcadeDB before 26.7.2 is reachable by authenticated schema administrators through JavaSc
Exploit-DB